| शीर्षक | thu-pacman chitu <0.1.0 Deserialization |
|---|
| विवरण | chitu is a high-performance inference framework for large language models (LLM). A vulnerability has been identified within its codebase regarding the use of the torch.load function. In the model loading process of Chitu, the torch.load function is repeatedly utilized to load checkpoint files without specifying the weights_only=True parameter. This oversight allows the function to deserialize the entire content of the checkpoint file, including any malicious Python objects and code that might be embedded.
More details: https://github.com/thu-pacman/chitu/issues/32 |
|---|
| स्रोत | ⚠️ https://github.com/thu-pacman/chitu/issues/32 |
|---|
| उपयोगकर्ता | ybdesire (UID 83239) |
|---|
| सबमिशन | 25/03/2025 10:47 AM (2 साल पहले) |
|---|
| संयम | 03/04/2025 09:17 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 303111 [thu-pacman chitu 0.1.0 chitu/chitu/backend.py torch.load ckpt_path/quant_ckpt_dir अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|